NSE7 Practice Exam 4 — 20 Questions

Question 1

A FortiGate is experiencing asymmetric routing due to route leaking between VRFs. The administrator wants to ensure that traffic using a specific VRF returns via the same path. Which THREE actions should be taken? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'set pbr-enforce-symmetric' on the VRF interfaces. Enabling 'set pbr-enforce-symmetric' on VRF interfaces forces the FortiGate to use policy-based routing (PBR) rules bidirectionally, ensuring that return traffic for a session follows the same path as the forward traffic. This is critical in asymmetric routing scenarios caused by route leaking between VRFs, as it overrides the default per-packet forwarding behavior and enforces symmetry at the session level.

Answer

Disable route leaking between VRFs

Answer

Increase the administrative distance of the leaked routes

Question 2

An organization has two FortiGate firewalls in an HA active-passive cluster. They notice that after a failover event, some users cannot access external resources. The administrator checks the HA configuration and finds that failover occurred correctly. What is the most likely cause of the connectivity issue?

Accepted Answer

VDOM links are not synchronized. In an HA active-passive cluster, VDOM links are not automatically synchronized between peers. After a failover, the new primary FortiGate may lack the VDOM link configurations required to route traffic between VDOMs, causing connectivity loss for users relying on inter-VDOM routing. This is a common misconfiguration because VDOM links are treated as local objects and must be explicitly replicated or re-created on the peer.

Answer

session-pickup is disabled

Answer

HA override is enabled

Answer

Gratuitous ARP is disabled

Question 3

An administrator deploys a FortiGate in transparent mode within a Layer 2 network. They apply a firewall policy with an antivirus profile to inspect traffic between two VLANs. What is a key characteristic of transparent mode that affects policy application?

Accepted Answer

Traffic is forwarded based on MAC addresses, and policies are applied transparently without changing the IP path. In transparent mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. This allows firewall policies, including antivirus inspection, to be applied to traffic between VLANs without modifying the IP path or requiring NAT, ensuring seamless integration into existing Layer 2 networks.

Answer

NAT is automatically applied to all traffic to preserve private IP addresses

Answer

Firewall policies are applied only to traffic entering the management interface

Answer

Each VDOM in transparent mode requires a unique IP address for management

Question 4

A FortiGate administrator notices that a VPN tunnel goes down and re-establishes every 30 minutes. The administrator checks the tunnel's phase1 and phase2 lifetimes. The phase1 lifetime is set to 86400 seconds and phase2 to 3600 seconds. What is the most likely cause of the tunnel dropping?

Accepted Answer

The DPD (Dead Peer Detection) timeout is triggered every 30 minutes. The VPN tunnel drops every 30 minutes, which matches a typical DPD (Dead Peer Detection) timeout interval. DPD is used to verify that the remote peer is still reachable; if no response is received within the DPD timeout (default often 30 minutes), the tunnel is torn down. The phase2 lifetime of 3600 seconds (1 hour) would cause rekey every hour, not 30 minutes. The phase1 lifetime of 86400 seconds (24 hours) is long. Therefore, the most likely cause is a DPD timeout triggering every 30 minutes, making option D correct.

Answer

The phase2 lifetime is set to 3600 seconds, causing rekey failures

Answer

The phase1 lifetime is too short, causing frequent renegotiation

Answer

The VPN tunnel is not configured to use NAT traversal

Question 5

A FortiGate administrator needs to use FortiManager to deploy a new security policy to all firewalls in a specific ADOM. Which two steps are part of the installation process? (Choose two.)

Accepted Answer

Run the install preview to see the changes that will be applied. The install preview in FortiManager allows the administrator to review the exact configuration changes (adds, deletes, modifications) that will be pushed to the target devices before committing the installation. This step is critical to avoid unintended policy disruptions, as it shows a diff of the policy package against the current device configuration. Option C is correct because selecting target devices and clicking 'Install' is the final manual step that triggers the actual deployment of the policy package to the chosen firewalls within the ADOM.

Answer

Configure revision history to track changes

Answer

Create a new ADOM for the policy package

Answer

Enable automation stitches to push the policy

Question 6

An organization wants to protect a public-facing web application against SQL injection and cross-site scripting (XSS) attacks. They have a FortiGate and a FortiWeb. What is the BEST deployment approach?

Accepted Answer

Deploy FortiWeb in reverse proxy mode in front of the web server. FortiWeb in reverse proxy mode is the best deployment because it terminates the client connection and inspects all HTTP/HTTPS traffic at the application layer (Layer 7) using specialized web application firewall (WAF) signatures and machine learning to detect and block SQL injection and XSS payloads before they reach the web server. Unlike a network firewall or IPS, FortiWeb is purpose-built for web application security and can decode, normalize, and analyze complex attack patterns that might evade simpler inspection methods.

Answer

Place the web server in a DMZ and rely on firewall policies

Answer

Use FortiGate WAF profile only

Answer

Use FortiGate IPS signatures for SQL injection and XSS

Question 7

An administrator needs to ensure that traffic between two VDOMs (VDOM_A and VDOM_B) is inspected by an IPS profile. Which TWO configuration elements are required? (Choose TWO.)

Accepted Answer

An inter-VDOM link with IP addresses in the same subnet. An inter-VDOM link is required to route traffic between VDOMs, and placing IP addresses in the same subnet on both ends ensures direct Layer 2 connectivity without routing overhead. This allows the firewall policies in each VDOM to control traffic flow, and applying an IPS profile on the policy in VDOM_A (with the inter-VDOM link as the destination interface) ensures that all traffic leaving VDOM_A toward VDOM_B is inspected by IPS.

Answer

NAT enabled on the inter-VDOM link

Answer

A firewall policy on VDOM_B with the source as the inter-VDOM link

Answer

An IPsec VPN between the VDOMs

Question 8

A FortiGate has two VDOMs: 'root' and 'customer'. The admin wants to route traffic from 'customer' to the internet via 'root', which has a BGP connection to an ISP. What is the required configuration?

Accepted Answer

Create an inter-VDOM link between 'customer' and 'root', and configure policies to allow traffic. Inter-VDOM links are the only supported method for routing traffic between VDOMs on the same FortiGate. An inter-VDOM link creates a virtual point-to-point connection between two VDOMs, allowing traffic to flow through firewall policies. Without this link, VDOMs are isolated and cannot exchange traffic, even if static routes or BGP are configured.

Answer

Enable VDOM forwarding on the WAN interface in 'root'

Answer

Configure a static route in 'customer' pointing to the 'root' VDOM's management IP

Answer

Place both VDOMs in the same VDOM group and enable route leak

Question 9

A FortiGate administrator is deploying a multi-VDOM setup for a service provider. The provider wants each customer VDOM to have its own administrative access, yet the overall device management (including firmware upgrades) should be centralized from the management VDOM. Which TWO statements are true regarding administrative VDOMs?

Accepted Answer

The management VDOM can be used to manage all other VDOMs. The management VDOM in a multi-VDOM FortiGate setup is specifically designed to provide centralized management. Administrators logged into the management VDOM can use the `execute` commands or the GUI to manage all other VDOMs, including configuration changes and monitoring, without needing to log into each VDOM individually.

Answer

Traffic VDOMs cannot have any administrative access

Answer

Each VDOM must have a separate management IP address

Answer

An administrator assigned to one VDOM can automatically view configurations of other VDOMs

Question 10

An organization is designing a Zero Trust Network Access solution with Fortinet. They want to ensure that only devices with up-to-date antivirus software can access sensitive applications. Which component is responsible for enforcing this requirement?

Accepted Answer

FortiClient EMS. FortiClient EMS is the correct component because it manages endpoint compliance policies, including antivirus status. It enforces the requirement by checking that devices have up-to-date antivirus software before issuing a ZTNA access token, which the FortiGate ZTNA gateway then validates to grant access.

Answer

FortiAnalyzer

Answer

FortiAuthenticator

Answer

FortiGate ZTNA gateway

Question 11

A FortiGate administrator is planning to use policy packages in FortiManager to manage firewall policies for multiple devices. Which TWO statements about policy packages are true?

Accepted Answer

Header and footer policies can be used to enforce common rules across all policies. Header and footer policies in FortiManager allow administrators to enforce common rules across all policies in a policy package. Header policies are evaluated before the main policy set, and footer policies are evaluated after, ensuring consistent security controls such as logging or traffic shaping are applied universally without manual duplication.

Answer

Policy packages are automatically applied to the device upon creation

Answer

Policy packages cannot include NAT policies

Answer

A policy package can contain policies for different VDOMs

Question 12

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP connection that has been active for 3600 seconds and will expire in 3599 seconds. The output shows 'proto=6' which indicates TCP (protocol 6), 'duration=3600' means the session has been active for 3600 seconds (1 hour), and 'expire=3599' means the session will expire in 3599 seconds. The 'proto_state=01' is a TCP state code indicating an established connection. This is a standard FortiGate diagnostic session output.

Answer

The session is a UDP DNS request

Answer

The session is being blocked by a firewall policy

Answer

The session is an SSL VPN tunnel

Question 13

An administrator runs 'diagnose sys top' and sees process 'httpsd' consuming 95% CPU. What is the best immediate action to alleviate the issue?

Accepted Answer

Change the administration HTTPS port and restrict access to trusted hosts. The 'httpsd' process handles HTTPS administration traffic. A CPU spike to 95% indicates a possible DoS attack or excessive management connections. Changing the HTTPS port and restricting access to trusted hosts immediately mitigates the attack surface without disrupting other services, as it limits the source of the malicious traffic.

Answer

Kill the httpsd process

Answer

Disable HTTPS administration access

Answer

Reboot the FortiGate

Question 14

An administrator is configuring a hub-and-spoke ADVPN with FortiGates. The spoke sites use dynamic public IP addresses. The administrator has enabled auto-discovery on the spoke and hub. However, shortcut tunnels are not being established between spokes that communicate frequently. What is the most likely missing configuration?

Accepted Answer

Auto-discovery is not enabled on the spoke's phase1 configuration. In a hub-and-spoke ADVPN, auto-discovery must be enabled on both the phase1 configuration of the spoke and the hub. If auto-discovery is not enabled on the spoke's phase1, the spoke will not send or process IKE informational exchanges (ADVPN messages) to negotiate shortcut tunnels with other spokes. This prevents dynamic shortcut establishment even if the hub has auto-discovery enabled.

Answer

The spoke's phase2 proposal includes a different encryption algorithm than the hub

Answer

The hub does not have a route to the spoke's local subnets

Answer

The spoke's VPN interface is not in the same VDOM as the hub

Question 15

A FortiGate administrator notices that files submitted to FortiSandbox are receiving verdicts but the firewall is not automatically blocking the detected malware. The FortiSandbox integration is configured under Security Fabric > External Connectors. What additional configuration is required to enforce blocking based on FortiSandbox verdicts?

Accepted Answer

Enable the 'fortisandbox' option in the antivirus profile applied to the firewall policy. The FortiSandbox verdict integration requires the antivirus profile applied to the firewall policy to have the 'fortisandbox' option enabled. This option allows the FortiGate to query FortiSandbox for verdicts and automatically block files that are determined to be malicious. Without this setting in the antivirus profile, the FortiGate will receive verdicts but will not enforce blocking actions on the traffic.

Answer

Enable 'Inline Scan' on the FortiSandbox connector

Answer

Configure an automation stitch to quarantine files based on verdict

Answer

Enable 'Block malicious files' in the FortiSandbox connector settings

Question 16

A FortiGate administrator wants to ensure that only devices with an up-to-date antivirus and OS patch level can access a sensitive application published via ZTNA. Which ZTNA component should the administrator configure to enforce this requirement?

Accepted Answer

ZTNA tags with posture checks. ZTNA tags with posture checks allow the FortiGate to verify endpoint compliance (e.g., antivirus version, OS patch level) before granting access to a ZTNA-published application. The FortiGate collects posture data from the FortiClient endpoint and compares it against configured compliance rules; only devices that meet the requirements receive the appropriate ZTNA tag and are allowed through the ZTNA proxy.

Answer

ZTNA proxy configuration

Answer

SSL VPN portal settings

Answer

Firewall policy with application control

Question 17

A FortiGate VPN tunnel shows 'phase1 negotiation failed' in the logs. The remote gateway is a third-party device. The debug command 'diagnose vpn ike config' shows mismatched proposals. Which setting is MOST likely incorrect on the FortiGate?

Accepted Answer

The encryption algorithm (e.g., AES256 vs 3DES). The 'diagnose vpn ike config' command displays the IKE proposal parameters (encryption, authentication, DH group) that the FortiGate is configured to offer. When the log shows 'phase1 negotiation failed' and the debug output indicates 'mismatched proposals', it means the FortiGate's configured encryption algorithm (e.g., AES256) does not match any algorithm supported by the remote third-party device (e.g., 3DES). This is the most direct cause of proposal mismatch, as IKE phase 1 requires both sides to agree on a common transform set.

Answer

The pre-shared key

Answer

The local ID type

Answer

The DPD configuration

Question 18

A FortiGate is configured with ECMP routing to balance traffic across two default routes via two ISPs. The administrator wants to ensure that traffic from the same source-destination pair always uses the same ISP. Which ECMP load balancing method should be configured?

Accepted Answer

source-dest-ip. The source-dest-ip method hashes the source and destination IP addresses to compute a consistent path for all packets in a given flow. This ensures that traffic from the same source-destination pair always uses the same ISP, meeting the requirement for flow-based persistence without per-packet load balancing.

Answer

source-ip

Answer

per-packet

Answer

session

Question 19

A customer reports intermittent connectivity issues between two internal subnets separated by a FortiGate firewall. The traffic is allowed by the policy, but users experience timeouts during peak hours. Which troubleshooting step should you take first?

Accepted Answer

Check the session table for session limits and session congestion.. Intermittent connectivity during peak hours strongly suggests session table exhaustion or session congestion. The FortiGate's session table has a finite capacity, and when it fills up, new sessions are dropped, causing timeouts. Checking the session table for limits and congestion is the fastest, least intrusive first step to confirm whether the firewall is running out of session resources before performing more complex diagnostics.

Answer

Run a packet sniffer on the FortiGate to capture traffic between the subnets.

Answer

Disable hardware acceleration on the FortiGate.

Answer

Configure SNAT on the policy to translate the source IP.

Question 20

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal application. The application is accessed via HTTPS. Which component must be configured on the FortiGate to act as a reverse proxy for the application?

Accepted Answer

ZTNA proxy. ZTNA proxy is the FortiGate feature that acts as a reverse proxy, terminating the client connection and initiating a new connection to the internal application. It enforces access policies based on identity and device posture.

Answer

FortiClient EMS

Answer

SSL-VPN portal

Answer

ZTNA inline CASB